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Abstract 

Many Embedded Systems are indeed Software Based Control Sys- 
tems (SBCSs), that is control systems whose controller consists of 
control software running on a microcontroller device. This motivates 
investigation on Formal Model Based Design approaches for automatic 
synthesis of SBCS control software. In previous works we presented 
an algorithm, along with a tool QKS implementing it, that from a for- 
mal model (as a Discrete Time Linear Hybrid System, DTLHS) of the 
controlled system (plant), implementation specifications (that is, num- 
ber of bits in the Analog-to- Digital, AD, conversion) and System Level 
Formal Specifications (that is, safety and liveness requirements for the 
closed loop system) returns correct-by-construction control software 
that has a Worst Case Execution Time (WCET) linear in the number 
of AD bits and meets the given specifications. In this technical report 
we present full experimental results on using it to synthesize control 
software for two versions of buck DC-DC converters (single-input and 
multi-input), a widely used mixed-mode analog circuit. 
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1. Every T seconds {sampling time) do 

2. Read AD conversion x of plant sensor outputs x 

3. If (x is not in the Controllable_Region) 

4. Then // Exception (Fault Detected): 

5. Start Fauh Isolation and Recovery (FDIR) 

6. Else // Nominal case: 

7. Compute (Control_Law) command u from x 

8. Send DA conversion u of u to plant actuators 

Figure 1: A typical control loop skeleton 

1 Introduction 

Many Embedded Systems are indeed Software Based Control Systems (SBCSs). 
An SBCS consists of two main subsystems: the controller and the plant. Typ- 
ically the plant is a physical system consisting, for example, of mechanical or 
electrical devices whereas the controller consists of control software running 
on a microcontroller. In an endless loop, the controller reads sensor outputs 
from the plant and sends commands to plant actuators in order to guaran- 
tee that the closed loop system (that is, the system consisting of both plant 
and controller) meets given safety and liveness specifications {System Level 
Formal Specifications). 

Software generation from models and formal specifications forms the core 
of Model Based Design of embedded software [2j. This approach is par- 
ticularly interesting for SBCSs since in such a case system level (formal) 
specifications are much easier to define than the control software behavior 
itself. 

Fig. [T] shows the typical control loop skeleton for an SBCS. Measures 
from plant sensors go through an AD {analog-to- digital) conversion {quan- 
tization) before being processed (line |2| and commands from the control 
software go through a DA {digital-to- analog) conversion before being sent to 
plant actuators (line|8]). Basically, the control software design problem for 
SBCSs consists in designing software implementing functions Control_Law 
and Controllable_Region computing, respectively, the command to be sent 
to the plant (line[7]) and the set of states on which the Control_Law function 
works correctly {Fault Detection in linejs]). 

In |5] we presented an algorithm and a tool QKS that from the plant 
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model (as a hybrid system), from formal specifications for the closed loop 

system behaviour {System Level Formal Specifications) and from implemen- 
tation specifications (that is, number of bits used in the quantization process) 
can generate correct-by-construction control software satisfying the given 
specifications. 

In this technical report we present full experimental results on using it 

to synthesize control software for two versions of buck DC-DC converters 
(single-input and multi- input), a widely used mixed-mode analog circuit. 

2 Background 

We denote with [n] an initial segment {1, . . . , n} of the natural numbers. We 
denote with X = [xi, . . . , x„] a finite sequence (list) of variables. By abuse 
of language wc may regard sequences as sets and we use U to denote list 
concatenation. Each variable x ranges on a known (bounded or unbounded) 
interval either of the reals or of the integers (discrete variables). We 
denote with Vx the set Hiex To clarify that a variable x is continuous 
(i.e. real valued) we may write x'^. Similarly, to clarify that a variable x 
is discrete (i.e. integer valued) we may write x'^. Boolean variables are 
discrete variables ranging on the set B = {0, 1}. We may write to denote 
a boolean variable. Analogously {X'^, X'') denotes the sequence of real 
(integer, boolean) variables in X. Finally, if a; is a boolean variable we write 
X for {1 — x). 

2.1 Predicates 

A linear expression over a list of variables X is a linear combination of vari- 
ables in X with real coefficients. A linear constraint over X (or simply a 
constraint) is an expression of the form L(X) < b, where L(X) is a linear 
expression over X and 6 is a real constant. 

Predicates are inductively defined as follows. A constraint C (X) over a list 
of variables X is a predicate over X. If A{X) and B{X) are predicates over X, 
then {A{X) AB{X)) and {A{X)V B{X)) are predicates over X. Parentheses 
may be omitted, assuming usual associativity and precedence rules of logical 
operators. A conjunctive predicate is a conjunction of constraints. For linear 
constraints we write: L{X) > b for -L{X) < -6, L{X) = b for {{L{X) < b) 
A {—L{X) < —b)) and a<a;<6fora;>aA2;<6, being x e X. 
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A valuation over a list of variables X is a function v that maps each 
variable a; G X to a value v{x) in V^. We denote with X* G Vx the sequence 
of values [f (xi), . . . , v{xn)]. By abuse of language, we call valuation also the 
sequence of values X*. A satisfying assignment to a predicate P over X is a 
valuation X* such that P{X*) holds. Abusing notation, we may denote with 
P the set of satisfying assignments to the predicate P{X). Two predicates 
P and Q over X are equivalent, notation P = Q, ii they have the same set 
of satisfying assignments. 

A variable a; G X is said to be bounded in P if there exist a, b eV^ such 
that P{X) imphes a < x < b. A predicate P is bounded if all its variables 
are bounded. 

Given a constraint C{X) and a fresh boolean variable {guard) y ^ X, 
the guarded constraint y — )■ C{X) (if y then C{X)) denotes the predicate 
((y = 0) V C{X)). Similarly, we use y C{X) (if not y then C{X)) to 
denote the predicate {{y = 1) V C{X j). A guarded predicate is a conjunction 
of either constraints or guarded constraints. 

When a guarded predicate is bounded, it can be easily transformed into 
a conjunctive predicate, as stated by the following proposition. 

Proposition 1. For each bounded guarded predicate P{X), there exists an 
equivalent bounded conjunctive predicate Q{X). 

3 Discrete Time Linear Hybrid Systems 

In this section we introduce our class of Discrete Time Linear Hybrid Systems 
(DTLHS for short). 

Definition 1. A Discrete Time Linear Hybrid System is a tuple % = {X, 
U, Y, N) where: 

• X = X^ U X'^ U is a finite sequence of real (X^), discrete (X'^) and 
boolean (X'^) present state variables. We denote with X' the sequence 
of next state variables obtained by decorating with ' all variables in X. 

• U = Li Li U'^ is a finite sequence of input variables. 

• Y = Y^ Li Y''' Li Y^ is a finite sequence of auxiliary variables. Auxil- 
iary variables are typically used to model modes (e.g., from switching 
elements such as diodes) or uncontrollable inputs (e.g., disturbances). 
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Figure 2: Single-input buck DC-DC converter 



• N{X, U, Y, X') is a conjunctive predicate over X U U UY U X' defining 
the transition relation ( next state ) of the system. 

A D TLHS is bounded if predicate N is bounded. 

By Prop. [T| any bounded guarded predicate can be transformed into 
a conjunctive predicate. For the sake of readability, we will use bounded 
guarded predicates to describe the transition relation of bounded DTLHSs. 
Note that DTLHSs can effectively model linear algebraic constraints involv- 
ing both continuous as well as discrete variables. Therefore many embedded 
control systems may be modeled as DTLHSs. 

4 Single-input Buck DC-DC Converter 

The buck DC-DC converter (Fig. [2]) is a mixed-mode analog circuit convert- 
ing the DC input voltage {Vin in Fig. [2]) to a desired DC output voltage 
{vo in Fig. [2]). As an example, buck DC-DC converters are used off-chip to 
scale down the typical laptop battery voltage (12-24) to the just few volts 
needed by the laptop processor (e.g. [8j) as well as on-chip to support Dy- 
namic Voltage and Frequency Scaling (DVFS) in multicore processors (e.g. 
[31 [7]). Because of its widespread use, control schemas for buck DC-DC con- 
verters have been widely studied (e.g. see |S1 El E] ) • The typical software 
based approach (e.g. see [5]) is to control the switch u in Fig. [2] (typically 
implemented with a MOSFET) with a microcontroller. 

Designing the software to run on the microcontroller to properly actu- 
ate the switch is the control software design problem for the buck DC-DC 
converter in our context. 
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The circuit in Fig. |2]can be modeled as a DTLHS Ti = {X, U, Y, N). The 
circuit state variables are ii and vc- However we can also use the pair il, 
vo as state variables in model since there is a linear relationship between 

ii, Vc and Vq, namely: vq = -^^^tr^l H Xr^c- Such considerations lead 

to use the following sets of variables to model Ti: X = X*" = [z^, vq], U = 

= [u],Y = U Y^ with = i^, Vd] and Y^ = [q]. Note how n 

auxiliary variables Y stem from the constitutive equations of the switching 
elements (i.e. the switch u and the diode D in Fig. [2]). From a simple circuit 
analysis (e.g. see [4j) we have the following equations: 



ii = ai,ih + ^1,2^0 + ai^sVD (1) 

V'o = Ci2,lh + a2,2Vo + a2,3VD (2) 

where the coefficients aij depend on the circuit parameters R, ri, rc, L 
and C in the following way: ai^i = —j;, cti,2 = 0,1,3 = ~Zi (^2,1 = 

+ «2,2 = ^["^ + ^2,3 = -zvtk- Using a discrete time 
model with sampling time T (writing a;' for a;(t + 1)) we have: 



h' = (1 + Tai^i)iL + Tai^2Vo + Tai^^vn (3) 
Vo = Ta2,iiL + (1 + Ta2,2)vo + ^'02,3^ d- (4) 

The algebraic constraints stemming from the constitutive equations of 
the switching elements are the following: 



q ^ VD = Ronio (5) 

q ^ iD>Q (6) 

U ^ Vu = Roniu (7) 

VD = Vu- Vin (8) 



q 

u 
in 



VD = Rosio 

VD<0 

Vu = RoS^u 

ii - iu 



(9) 
(10) 

(11) 
(12) 



The transition relation of is given by the conjunction of the con- 
straints in Eqs. (|3|-(12) and the following explicit (safety) bounds: —4 < 
iL<4:A-l<vo<7 A -10^ <iD< 10^ A -10^ < < 10^ A -10^ < Vu < 
W A -10^ <Vd< 10^. 
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4.1 Modelling Robustness on Input Vin and Load R 

In this section we address the problem of refining the model given in Sect. |4] 
so as to require a controller for our single-input buck to be robust to foreseen 
variations in the load R and in the power supply Vin- That is, given tolerances 
Pn and PVi„j we want the controller output by QKS for our single- input 
buck to work for any R G [max{0,-R(l — pr)},R{1 + pn)] and any Vin G 
[max{0, Vin{l - Pvj}, Vi„(l + pvj]- 

Variations in the power supply are modeled by replacing Eq. ([s]) in Sect.|4] 
with the following: 



VD <Vu-Vin{l- PV,„) (13) VD>Vu-Vin{l + PV,n) (14) 

Along the same lines, we may model also variations in the load R. How- 
ever, since N dynamics is not linear in R, much more work is needed (along 
the lines of [T]). To this aim, we proceed as follows. 

The only equation depending on R is Eq. ^ of Sect. |4| Consider con- 
stantsa2,i(i?) = + a,,,iR) = ^[^ + ^], a,,,iR) = 

as (nonlinear) functions of R. It is easy to see that 02,1 (-R), 02,2 (-R) are mono- 
tonically increasing functions for R G M^, while 02,3 (-R) is monotonically de- 
creasing for R G M^. Thus, if signs of iliVoiVd are known, it is possible to 
replace Eq. (j4| with two inequalities vq > T a2^i{Rj^)i l + {)-+T a2^2{.Rvo))''^o + 
Ta2^i,{R~^)vD and vq < Ta2,i{RtJiL + (1 + r«2,2 (^jo))fo + Ta2^z{Rtu)^D, 
being 

• i?- = if w > then R{1 - pr) else R{1 + pr) and = if w > 

then R{1 + pr) else R{1 — pr) for w E {il, vq}] 

• R-^ = if > then R{1 + pr) else R{1 - pr) and = if > 
then R{1 — pr) else _R(1 + pr). 



This leads us to replace Eq. (|4]) of Sect. |4]with the equations in Fig. [s] 
Note that, w.r.t. the model in Sect.H in Fig. p^we add to 11 auxiliary 



boolean variables z^^^ Zy^j z^^j Zppp, Zppp, Zppnj Zpp^j Zp^pi Zp^p^ Zp^ni Zpjim 
Znppt Znppj Zfipni z^pni Znnpi z^npi Znnni Znnn with the followiug meaning. The 



boolean variable Zi^ \zvoi ^vo] is true iff ii [vq, Vd] is positive (see Eqs. (15) 



and (18) [Eqs. (|16|) and (19), Eqs. (17) and (20)]). The boolean variable Zabc 



with a, 6, c G {p,n}, is true iff (if a = p then ii > else < 0) A (if 
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Figure 3: DTLHS Buck Model Robust on R 
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Figure 4: Multi-input Buck DC-DC converter 



b = p then vq > else < 0) A (if c = p then vd > else I'd < 0). 
This is stated by Eqs. (21)-(28). Finally, we use boolean variables Zabc as 
guards for the inequalities replacing Eq. Q as stated before. This is done in 
Eqs. (|29|-(|44l). 



5 Multi-input Buck DC-DC Converter 

A multi- input buck DC-DC converter [6j (Fig.|4]), consists of n power supplies 
with voltage values Vi < . . . < Vn, n switches with voltage values f", . . . 
and current values J", . . . , J^, and n input diodes Dq, . . . , -D„_i with voltage 
values Vq,..., v^_i and current values Iq,..., (in the following, we will 
also write Vd for Vq and id for Iq). As for the converter in Sect. 4| the state 
variables are il and vq- Differently from the converter in Sect. |4, the action 
variables are Ui, . . . ,m„, thus a control software for the n-input buck dc-dc 
converter has to properly actuate the switches 

We model our n-input buck DC-DC converter with DTLHS T-i = (X, f/, 
F, iV), where X = X"- = [i^, vq], U = = [m, . . . , and y = y U F'' 
with y = [vD, , . . .,vti, ^D, /r, i:,v^, <] and = [go, • • • , 
g„„i]. As for the predicate N, from a simple circuit analysis (e.g. see [4J) we 
have that state variables constraints are the same as Eqs. (g and iQ of the 
converter in Sect. HI 

The algebraic constraints stemming from the constitutive equations of 
the switching elements are the following (where i and j range in [n — 1] and 
[n] respectively): 
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^ vJ = RosIf 


(55) 




n 


(50) 


VD 


= v^ + vf-V, 


(56) 




1=1 


VD 


= Vl-Vn 


(57) 



Finally, is given by the conjunction of Eqs. ^ and (|4]) of Sect. |4| 
Eqs. (45)-(57) and the following explicit (safety) bounds: —4 <iL^ 4A— 1 < 

vo <7 A -10^ <iD< A Ar=i -10^ < < /\ Ar=i -lo^ < < < 



5.1 Modelling Robustness on Inputs Vi and Load R 

In this section we address the problem of refining the model given in Sect. [5] 
so as to require a controller for our multi-input buck to be robust to foreseen 
variations in the load R and in the power supplies Vi (for i E [n]). As it 



is explained in Sect. 4.1, given tolerances and py. (for i E [n]), we want 
the controller output by QKS for our multi-input buck to work for any R G 
[max{0,R{l-pR)},R{l + pR)] and any 1/^ E [max{0, 1^(1 - pyj}, 1/^(1 + 
(for i E [n]). 



Variations in the power supplies are modeled by replacing Eqs. (56) 



and (57) in Sect, p^with the following (where i ranges in [n — 1]): 



VD<vr + vf-mi-pvJ (58) 
VD>v^ + vf' -Viil + pv^) (59) 



^D<<-K(l-pyJ (60) 
i^D><-K(l + PyJ (61) 



As for the robustness w.r.t. the load R, since the only equation depending 
on R is Eq. ^ of Sect. |4| which also holds for the multi-input buck, the same 
reasoning of Sect. 4.1 may be applied. Thus, we have to replace Eq. (|4]) of 
Sect. |4]with the equations in Fig. |3j 
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6 Experimental Results 



In this section we present our experimental results about running QKS [5] 
on the buck models described in Sects. |4] and |5j Namely, we will present 
experimental results on the robust model for the single-input buck described 

(non-robust) model for the multi-buck 
All experiments run on an Intel 3.0 GHz 



in Sect. 



4.1 



(Sect. 6.1) and on the 
described in Sect. |5j (Sect. 



6.2). 



hyperthreaded Quad Core Linux PC with 8 GB of RAM. 



6.1 Single-input Buck 

We run QKS on the single-input buck model taking into account foreseen 



variations in the load R and in the power supply Vin (see Sect. 4.1). Since 
QKS also require as input the number of AD bits b (see |5] for details), we run 
multiple times QKS for different values of b, each time obtaining a controller 
K''. All other constants introduced in Sect. [Hare fixed as follows: T = 10~^ 
sees, L = 2 - 10"^ H, tl = 0.1 n, rc = 0.1 n, R = 5 n, C = 5 ■ 10"^ F, 
Vi = 15 V, PR = py,„ = 25%, Ron = fi, Ros = 10^ n. 

Tabs. [T], [2] and |3] show our experimental results. Columns in Tab. [TJhave 
the following meaning. Column b shows the number of AD bits (see [5J for 
details). Columns labeled Control Abstraction show performance for control 
abstraction computation (see [5j for details) and they show running time 
(column CPU, in sees), memory usage {MEM, in bytes), the number of tran- 
sitions in the generated control abstraction (Arcs), the number of self-loops 
in the maximum control abstraction (MaxLoops) , and the fraction of loops 
that are kept in the minimum control abstraction w.r.t. the number of loops 
in the maximum control abstraction (LoopFrac) . 

Columns labeled Controller Synthesis show the computation time (col- 
umn CPU, in sees) for the generation of K^, and the size of its OBDD rep- 
resentation [OBDD, number of nodes). The latter is also the size (number 
of lines) of K'' C code synthesized implementation. Finally, columns labeled 
Total show the total computation time (column CPU, in sees) and the mem- 
ory {MEM, in bytes) for the whole process (i.e., control abstraction plus 
controller source code generation), as well as the final outcome /i G {SOL, 
NoSOL, Unk} of QKS (see [5j for details). 

For each MILP problem solved in QKS (see [S] for details). Tabs. [2] and [s] 
show (as a function of b) the total and the average CPU time (in seconds) 
spent solving MILP problem instances, together with the number of MILP 
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Table 2: Single-input buck DC-DC converter: number of MILPs and time to 
solve them 



MILP 




6 = 8 






6 = 9 




Num 


Avg 


Time 


Num 


Avg 


Time 


1 


6.6e+04 


7.0e-05 


4.6e+00 


2.6e+05 


7.0e-05 


1.8e+01 


2 


4.0e+05 


1.5e-03 


3.3e+02 


1.6e+06 


1.4e-03 


l.le+03 


3 


2.3e+05 


9.1e-04 


2.1e+02 


9.2e+05 


9.2e-04 


8.4e+02 


4 


7.8e+05 


9.9e-04 


7.7e+02 


4.4e+06 


l.Oe-03 


4.5e+03 


5 


4.3e+05 


2.8e-04 


1.2e+02 


1.7e+06 


2.8e-04 


4.9e+02 



Table 3: Single-input buck DC-DC converter: number of MILPs and time to 
solve them (continuation of Tab. [2]) 



MILP 




6 = 10 






6= 11 




Num 


Avg 


Time 


Num 


Avg 


Time 


1 


l.Oe+06 


2.7e-04 


2.8e+02 


4.2e+06 


2.3e-04 


9.7e+02 


2 


6.4e+06 


3.8e-03 


1.3e+04 


2.5e+07 


3.3e-03 


4.6e+04 


3 


3.7e+06 


3.0e-03 


l.le+04 


1.5e+07 


2.6e-03 


3.8e+04 


4 


3.0e+07 


2.6e-03 


7.8e+04 


2.6e+08 


2.2e-03 


5.7e+05 


5 


6.8e+06 


1.8e-03 


1.3e+04 


2.7e+07 


1.6e-03 


4.2e+04 
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Figure 5: Single-input robust buck: controlled region with 6 = 8 bits 



instances solved. Columns in Tabs. |2] and [3] have the following meaning: Num 
is the number of times that the MILP problem of the given type is called, 
Time is the total CPU time (in sees) needed to solve all the Num instances 
of the MILP problem of the given type, and Avg is the average CPU time (in 
sees), i.e. the ratio between columns Time and Num. Each row in Tabs. [2] 
and |3] refer to a type of MILP problem solved, see [5j for details. 

Finally, in Figs.|5]-[8]we show the guaranteed operational range [controlled 
regions, see [5] for details) of the controllers generated for the single-input 
buck by QKS. 



6.2 Multi-input Buck 

We run QKS on the multi-input buck model described in Sect. [5j Differently 
from Sect. |6.1[ we fix the number of AD bits h for QKS, namely h = 10. 
On the other hand, we run multiple times QKS by varying the number n 
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-4-3-2-1 1 2 3 4 

Figure 6: Single-input robust buck: controlled region with 6 = 9 bits 
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-4-3-2-1 1 2 3 4 



Figure 7: Single-input robust buck: controlled region with 6 = 10 bits 
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-4-3-2-1 1 2 3 4 

Figure 8: Single- input robust buck: controlled region with 6 = 11 bits 
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of inputs for the multi-input buck. As for input voltages, we have Vi = lOi 
V for all i E \n\. All other constants introduced in Sect. Isl are fixed as in 



Sect. 16.11 

Tabs. [4], [5] and |6] show our experimental results. Columns in Tab. |4]have 
the following meaning. Column n shows the number of inputs of the multi- 
input buck (see Sect, [sjfor details). All other columns of Tab. |4| as well as 
of Tabs. [5] and |6] have the same meaning of the same columns of Tabs. [T], [2] 
andUl 

Finally, in Figs. |9]-12 we show the guaranteed operational range {con- 
trolled regions, see [5j for details) of the controllers generated for the multi- 
input buck by QKS. 



7 Conclusions 

We presented experimental results on using the QKS tool [S], to support a 
Formal Model Based Design approach to control software. Our experiments 
have been carried out on two versions of the buck DC-DC converter, namely 
the single-input and the multi-input versions. We also showed how robust 
controllers may be generated for such bucks, namely by taking into account 
also foreseen variations on some important buck parameters such as load and 
input power supplies. 
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Table 5: Multi-input buck DC-DC converter: number of MILPs and time to 
solve them 



MILP 




n = 1 






n = 2 




Num 


Avg 


Time 


Num 


Avg 


Time 


1 


l.Oe+06 


2.0e-04 


2.1e+02 


l.Oe+06 


2.1e-04 


2.2e+02 


2 


6.4e+06 


1.4e-03 


5.1e+03 


1.3e+07 


1.9e-03 


1.6e+04 


3 


3.7e+06 


8.8e-04 


3.2e+03 


7.4e+06 


1.6e-03 


l.le+04 


4 


8.7e+06 


l.Oe-03 


8.9e+03 


1.7e+07 


1.7e-03 


2.8e+04 


5 


6.9e+06 


6.8e-04 


4.6e+03 


1.4e+07 


l.le-03 


1.5e+04 



Table 6: Multi-input buck DC-DC converter: number of MILPs and time to 
solve them (continuation of Tab, [sj) 



MILP 




n = 3 






n = 4 




Num 


Avg 


Time 


Num 


Avg 


Time 


1 


l.Oe+06 


2.1e-04 


2.2e+02 


l.Oe+06 


2.2e-04 


2.3e+02 


2 


2.5e+07 


3.0e-03 


4.6e+04 


5.1e+07 


4.5e-03 


1.2e+05 


3 


L5e+07 


2.2e-03 


3.2e+04 


2.9e+07 


2.9e-03 


8.6e+04 


4 


3.2e+07 


2.4e-03 


7.9e+04 


6.3e+07 


3.2e-03 


2.0e+05 


5 


2.7e+07 


L6e-03 


4.3e+04 


5.5e+07 


2.1e-03 


l.le+05 
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Figure 9: Multi-input buck: controlled region with n = 1 inputs 
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Figure 10: Multi-input buck: controlled region with n = 2 inputs 
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Figure 11: Multi-input buck: controlled region with n = 3 inputs 
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Figure 12: Multi-input buck: controlled region with n = A inputs 
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